#922052 Please grant DMs sftp/scpb access to ssh.upload.debian.org

Package:
dput
Source:
dput
Submitter:
Micah Anderson
Date:
2026-09-30 06:15:04 UTC
Severity:
wishlist
Tags:
#922052#5
Date:
2014-01-27 19:38:51 UTC
From:
To:
It would be nice if ssh-upload were the default transport for uploading files in debian. Is there a particular reason why it isn't set as the default now?

thanks,
micah
#922052#10
Date:
2014-07-14 16:55:16 UTC
From:
To:
I agree, the default upload method should be somehow encrypted, ssh is one
good option.

Having dput happen through ssh hides lots of information from network
observers, like which package is being uploaded, which machine is uploading
the new package, etc.  The provides information to attackers, like which
machine a Debian Developer uses to build their packages.
#922052#15
Date:
2018-11-27 12:07:12 UTC
From:
To:
On Mon, 27 Jan 2014 Micah Anderson <micah@debian.org> wrote:>
While ssh-upload is clearly better than FTP and I would like to see it
as the default upload method too, it still has two important shortcomings:

1. Only Debian Developers can use it, as DM do not have an account;

2. It does not support the DELAYED queue.

Paride
#922052#20
Date:
2018-11-27 15:16:30 UTC
From:
To:
We surely have ssh keys for most DMs these days, via gitlab,
monkeysphere, or some other mechanism.  Maybe we could we grant those
DMs access?

Alternately, can we provide anonymous ssh access to ssh-upload and just
be done with the whole FTP mess once and for all?  it's 2018, and far
too much of the Internet is actively hostile to cleartext traffic.

Even OpenBSD's CVS server uses anonymous ssh for access these days:

https://www.openbsd.org/anoncvs.html

If it doesn't support the DELAYED queue, that should be fixed.  is there
a reason that DELAYED isn't available via ssh-upload?
#922052#25
Date:
2019-02-10 07:35:09 UTC
From:
To:
The Debian infrastructure support for SSH upload may not be good
enough to be the default transport for this tool.
#922052#36
Date:
2019-02-10 07:38:48 UTC
From:
To:
Control: tags -1 + moreinfo

If I understand this suggestion, it seems out of scope for this bug
report. Would you re-post that suggestion for discussion where it
might result in action?

I don't know; Paride, is this problem already reported in some bug
report? Which one?
#922052#41
Date:
2019-02-11 15:25:48 UTC
From:
To:
Control: clone 736859 -2
Control: retitle -2 ftp.debian.org
Control: severity -2 wishlist
Control: retitle -2 Please grant DMs sftp/scpb access to ssh.upload.debian.org

The default dupload target for debian is described this way in
/etc/dupload.conf:

$cfg{'ftp-master'} = {
    fqdn => 'ssh.upload.debian.org',
    method => 'scpb',
    incoming => '/srv/upload.debian.org/UploadQueue/',
    distblacklist => qr/^(?:UNRELEASED|.*-security$)/,
    # Files pass on to dinstall on ftp-master which sends emails itself.
    dinstall_runs => 1,
};

According to Paride above, DMs cannot use this useful queue because
debian doesn't know about their ssh keys.

Please enable scpb access to ssh.upload.debian.org for Debian
Maintainers based on ssh keys that we know about for them -- either by
pulling them from salsa, from monkeysphere, or some other mechanism.

Thanks for maintaining the debian upload queues!