{"action":"created","issue":{"url":"https://api.github.com/repos/wikimedia/service-runner/issues/142","repository_url":"https://api.github.com/repos/wikimedia/service-runner","labels_url":"https://api.github.com/repos/wikimedia/service-runner/issues/142/labels{/name}","comments_url":"https://api.github.com/repos/wikimedia/service-runner/issues/142/comments","events_url":"https://api.github.com/repos/wikimedia/service-runner/issues/142/events","html_url":"https://github.com/wikimedia/service-runner/pull/142","id":190862032,"number":142,"title":"Added support for specifying the repo key","user":{"login":"Pchelolo","id":814754,"avatar_url":"https://avatars.githubusercontent.com/u/814754?v=3","gravatar_id":"","url":"https://api.github.com/users/Pchelolo","html_url":"https://github.com/Pchelolo","followers_url":"https://api.github.com/users/Pchelolo/followers","following_url":"https://api.github.com/users/Pchelolo/following{/other_user}","gists_url":"https://api.github.com/users/Pchelolo/gists{/gist_id}","starred_url":"https://api.github.com/users/Pchelolo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Pchelolo/subscriptions","organizations_url":"https://api.github.com/users/Pchelolo/orgs","repos_url":"https://api.github.com/users/Pchelolo/repos","events_url":"https://api.github.com/users/Pchelolo/events{/privacy}","received_events_url":"https://api.github.com/users/Pchelolo/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-11-21T23:06:07Z","updated_at":"2016-11-22T13:33:40Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/wikimedia/service-runner/pulls/142","html_url":"https://github.com/wikimedia/service-runner/pull/142","diff_url":"https://github.com/wikimedia/service-runner/pull/142.diff","patch_url":"https://github.com/wikimedia/service-runner/pull/142.patch"},"body":"@paravoid correctly pointed out that using `--force-yes` when installing packages from WMF apt repo is a terrible practice (https://gerrit.wikimedia.org/r/#/c/322368/), so add support for providing key URL so that we could fetch the key to the repo and properly add it to apt-get\r\n\r\ncc @wikimedia/services "},"comment":{"url":"https://api.github.com/repos/wikimedia/service-runner/issues/comments/262241386","html_url":"https://github.com/wikimedia/service-runner/pull/142#issuecomment-262241386","issue_url":"https://api.github.com/repos/wikimedia/service-runner/issues/142","id":262241386,"user":{"login":"paravoid","id":1330796,"avatar_url":"https://avatars.githubusercontent.com/u/1330796?v=3","gravatar_id":"","url":"https://api.github.com/users/paravoid","html_url":"https://github.com/paravoid","followers_url":"https://api.github.com/users/paravoid/followers","following_url":"https://api.github.com/users/paravoid/following{/other_user}","gists_url":"https://api.github.com/users/paravoid/gists{/gist_id}","starred_url":"https://api.github.com/users/paravoid/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/paravoid/subscriptions","organizations_url":"https://api.github.com/users/paravoid/orgs","repos_url":"https://api.github.com/users/paravoid/repos","events_url":"https://api.github.com/users/paravoid/events{/privacy}","received_events_url":"https://api.github.com/users/paravoid/received_events","type":"User","site_admin":false},"created_at":"2016-11-22T13:33:40Z","updated_at":"2016-11-22T13:33:40Z","body":"You should reference a key fingerprint, not a key URL. Even if the Wikitech page was authoritative (it's not, anyone can change that), referencing a URL is not more secure than just passing --force-yes; wikitech.wm.org is not more secure than apt.wm.org (https helps but it's still not a great idea to delegate cryptographic checks to the contents of a URL).\r\n\r\nAlso, I know it probably doesn't matter here but I can't help but notice the temp file vulnerability due to the predictably-named temporary file :)"}}
{"actor":{"display_login":"paravoid"}}