Re: Next steps from GTI TAC meeting on 2023-03-08 - Evaluate cost of glibc migration.

[Ian Kelling <iank@fsf.org>]

Konstantin Ryabitsev <konstantin@linuxfoundation.org> writes:

> In the case when we can't use the git tag note process, we can also do tarball
> uploads using our own "kup" tool that is done over ssh and uses the gitolite
> permission framework. I'm quite shocked that someone in the world still uses
> FTP for any uploads. :)

GNU already has a system for release uploads to https://ftp.gnu.org that
works very well and I help maintain it.

Debian uses ftp for package uploads according to
https://www.debian.org/security/faq and of course they support package
downloads over ftp too. There is nothing wrong with it for our use
case. Ssh would have the disadvantage of managing extra keys, but I'm
not opposed to adding it if it would make sense. If there are any
features lacking for the GNU ftp, we would be happy to add them. For GNU
maintainers to discuss potential improvements to the ftp the best place
is https://lists.gnu.org/mailman/listinfo/gnu-prog-discuss. There are
also multiple inherent advantages of GNU packages to use the GNU release
site. For example, for any changes to the set of keys gpg authorized to
upload, there is a manual review by FSF tech team and GNU volunteers.

-- 
Ian Kelling | Senior Systems Administrator, Free Software Foundation
GPG Key: B125 F60B 7B28 7FF6 A2B7  DF8F 170A F0E2 9542 95DF
https://fsf.org | https://gnu.org