luarocks.org accounts

[hishamhm]

A question mainly to @alerque who has set up the release automation for the various projects here:

Do all teams/projects hosted under lunarmodules have access to the lunarmodules API key for luarocks.org?

From a credential management standpoint, should we start considering separate luarocks.org accounts, at least for the larger projects that have millions of downloads? Or would that add too much setup burden at this time?

While we're still a tight-knit community, it feels okay to do things the way we're doing here (I even know face-to-face most of the people involved!), but as we start accepting more projects in, at one point it may become concerning if automating releases for one project gives upload access to all of them.

[Tieske]

creating multiple accounts would mean multiple email addresses right? that would be a hassle I guess.

Could we adapt LuaRocks so tokens get a limited scope? So we'd generate a token per project/team, with only access to 1 or more rocks.

[hishamhm]

creating multiple accounts would mean multiple email addresses right?

I don't know if LuaRocks accounts require a unique email address... I don't think so, but @leafo should know for sure.

Could we adapt LuaRocks so tokens get a limited scope? So we'd generate a token per project/team, with only access to 1 or more rocks.

I think that would require significant work in the MoonScript codebase of luarocks.org for adding backend and frontend work for token management... creating multiple accounts sounds more doable in the short term, if we don't need to create a new email address for each lunarmodules team.

[Tieske]

just tried, but it does require unique email addresses;

[alerque]

That isn't a Gmail specific feature, email suffixes like that are a universal standard.

[hishamhm]

I mean the fact that gmail automatically accepts arbitrary suffixes and forwards all emails with suffixes to the same inbox. That's not a universal feature supported by all mail providers, right? (If it is, I'm happy to learn!)

[alerque]

That's not a universal feature supported by all mail providers, right? (If it is, I'm happy to learn!)

Yes it is, it's part of some of the base protocol specs most MTAs are designed to cooperate with. Not 100% of providers implement it correctly, but a pretty good percentage of them do.

[Tieske]

That could probably work. But that would also require quite some overhead.

I assume we create an account per team. So;

• we need a naming convention for the email address to use, eg. 'lunarmodules+[teamname]@gmail.com'
• create a token in each account
• set the token in GHA for the team repo's

Possible issues;

• one of these days (if not already) 2FA will become mandatory? so it lands with 1 person who may no longer be hit by a bus. Can the account be made a "group" thing? accessible from multiple gmail accounts?

[alerque]

Another obnoxious issue related to this is the way LuaRocks.org resets publish dates when changing ownership. I'd be a little less adverse to all this splitting up if that got fixed.

I think Thijs has a point though: we might be introducing much more of a paint point by having separate accounts that can't be administered by a group. Right now the only reason we don't have a bus factor of 1 is because I hold the email and current API key but Hisham has admin access behind my back. That's okay for a status quo but it doesn't scale well to anybody else in the Lua ecosystem.